763 matches found
CVE-2025-47393
Memory corruption when accessing resources in kernel driver...
CVE-2026-22186 Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser
Bio-Formats versions up to and including 8.3.0 contain an XML External Entity XXE vulnerability in the Leica Microsystems metadata parsing component e.g., XLEF. The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity...
CVE-2026-22186
Bio-Formats up to 8.3.0 is affected by an XXE flaw in the Leica Microsystems metadata parsing (XLEF). The issue stems from insecure configuration of DocumentBuilderFactory when parsing Leica XML-based metadata, allowing external entity expansion and external DTD loading. Exploitation can trigger ...
CVE-2026-22186 Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser
Bio-Formats versions up to and including 8.3.0 contain an XML External Entity XXE vulnerability in the Leica Microsystems metadata parsing component e.g., XLEF. The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity...
CVE-2025-47393
Memory corruption when accessing resources in kernel driver...
Bio-Formats 代码问题漏洞
Bio-Formats is an Open Microscopy Environment open source Java library for reading and writing various microscopy imaging proprietary file formats. A code issue vulnerability exists in Bio-Formats 8.3.0 and prior versions that stems from an XML external entity vulnerability in the Leica...
BIT-GITEA-2025-68941
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...
CVE-2025-57705
CVE-2025-57705 affects QNAP QTS and QuTS hero systems. The issue is an allocation of resources without limits or throttling in the OS, which can be exploited by a remote attacker who already has an administrator account to prevent other systems, applications, or processes from accessing the same ...
CRLF Injection
Overview Affected versions of this package are vulnerable to CRLF Injection via the processing of untrusted HTTP headers. An attacker can access internal or external network resources by injecting carriage return and line feed characters into user-supplied headers. Remediation Upgrade cpp-httplib...
PT-2025-53754
Name of the Vulnerable Software and Affected Versions Hemmelig versions prior to 7.3.3 Description A Server-Side Request Forgery SSRF filter bypass exists in the webhook URL validation of the Secret Requests feature in Hemmelig, a messaging app with client-side encryption and self-destructing...
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...
CVE-2025-68941
Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources...
scsi: smartpqi: Fix device resources accessed after device removal
...
CVE-2021-47715 Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection
Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the addremoteschema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL...
CVE-2025-68477
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, an...
CVE-2025-65009
CVE-2025-65009 affects the WODESYS WD-R608U router (WDR122B V2.0 / WDR28). The admin password is stored in plaintext in a configuration file and can be accessed by an unauthorized user via direct reference to the resource. Only version WDR28081123OV1.01 has been tested and confirmed vulnerable; o...
CVE-2025-66586
In AzeoTech DAQFactory release 20.7 Build 2555, an access of resource using incompatible type vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process...
PT-2025-50737
Name of the Vulnerable Software and Affected Versions AzeoTech DAQFactory version 20.7 Build 2555 Description AzeoTech DAQFactory release 20.7 Build 2555 contains a flaw related to improper handling of resources. Specifically, an Access of Resource Using Incompatible Type issue exists when...
Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability
fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery SSRF vulnerability, which allows attackers to bypass private IP validation and access internal network resources...